0ffd1ef47f
Remove additional backslash
2020-11-19 23:15:38 -03:00
351a9920ed
Update win_mal_flowcloud.yml
2020-11-19 23:14:44 -03:00
266109f3d8
Update win_mal_ryuk.yml
2020-10-27 22:47:41 -03:00
514f9ccd28
Update win_mal_ryuk.yml
2020-10-27 22:42:15 -03:00
dbad6c637f
Update av_webshell.yml
2020-10-27 22:35:45 -03:00
0afe48a0a0
Update av_relevant_files.yml
2020-10-27 22:34:57 -03:00
95da1ec500
Update av_relevant_files.yml
2020-10-27 22:32:16 -03:00
d3c6d9df31
Update win_mal_ryuk.yml
2020-10-27 22:21:16 -03:00
98c7639db7
Update mal_azorult_reg.yml
2020-10-27 22:19:04 -03:00
8f4d6f802b
Update mal_azorult_reg.yml
2020-10-27 22:18:41 -03:00
9fd203e2a3
Update mal_azorult_reg.yml
2020-10-27 22:07:45 -03:00
0dfacd1f63
Fix
2020-10-15 20:27:10 -03:00
9795c95a9b
Update av_webshell.yml
2020-10-15 20:25:34 -03:00
345c3c6451
Fix
2020-10-15 20:24:31 -03:00
86ade194a4
Fix
2020-10-15 20:22:56 -03:00
acfe0633e2
Update win_mal_ursnif.yml
2020-10-15 16:18:38 -03:00
983e9cb9ae
Update win_mal_ryuk.yml
2020-10-15 16:18:14 -03:00
8d44548a2c
Update win_mal_flowcloud.yml
2020-10-15 16:16:08 -03:00
ef646e74d8
Update mal_azorult_reg.yml
2020-10-15 16:15:25 -03:00
69c90570ec
Update av_webshell.yml
2020-10-15 16:14:08 -03:00
cdaa5ef3a6
Update av_relevant_files.yml
2020-10-15 16:13:22 -03:00
7dc720cf13
Update av_password_dumper.yml
2020-10-15 16:11:52 -03:00
dea145cd5e
Update av_exploiting.yml
2020-10-15 16:11:24 -03:00
b343df2225
Further subtechnique updates
2020-06-17 11:31:40 -06:00
0fbfcc6ba9
Initial round of subtechnique updates
2020-06-16 14:46:08 -06:00
422b2bffd7
Fix rules with incorrect escaping of wildcars
...
A backslash before a wildcard needs to be escaped with another backslash.
2020-06-15 13:38:18 -04:00
9b8f8b7e09
Merge pull request #822 from NVISO-BE/win_mal_flowcloud
...
TA410 FlowCloud malware detection
2020-06-09 17:18:39 +02:00
a9bf22750a
Fixed bad indentation
2020-06-09 16:30:17 +02:00
4ce3ea735e
TA410 FlowCloud malware detection
2020-06-09 16:21:46 +02:00
d14d391761
Octopus Scanner malware rule
2020-06-09 16:12:05 +02:00
beb62dc163
fix: condition location
2020-05-15 12:06:34 +02:00
28dc2a2267
Minor changes
...
hints:
- contains doesn't require wildcards in the strings
- we can use 'endswith' instead of wildcard at the beginning of the string (it's the new way to describe it, we have to change all old rules that contain these wildcards some day)
- we can use "1 of them" to say that 1 of the conditions has to match
2020-05-15 11:33:36 +02:00
40ab1b7247
added 'action: global'
2020-05-14 23:33:08 -04:00
56a2747a70
Corrected missing condition
...
learning! fail fast & forward
2020-05-14 23:18:33 -04:00
fb1d8d7a76
Corrected typo
2020-05-14 23:04:14 -04:00
8aff6b412e
added rule for Blue Mockingbird (cryptominer)
2020-05-14 22:58:23 -04:00
09d1b00459
Changed level to ciritcal
2020-05-11 10:40:23 +02:00
c98be55d21
Update mal_azorult_reg.yml
2020-05-08 21:31:33 -04:00
61f061333b
Registry entry for Azorult malware
...
Detects registry keys used by Azorult malware
2020-05-08 21:26:24 -04:00
30d872f98f
Merge pull request #492 from booberry46/master
...
Bypass Windows Defender
2020-01-30 14:27:30 +01:00
a5b4b276d4
Add scriptlets
...
Adds .sct and .vbe.
2019-11-14 22:26:22 +01:00
0592cbb67a
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
cfe7ddbe5b
Update av_exploiting.yml
...
Not sure if the '' affects.
2019-11-06 16:16:49 +08:00
d096ab0e21
rules: AV rules updated to reflect 1.7.2 auf AV cheat sheet
2019-10-04 16:17:34 +02:00
f6fd1df6f4
Rule: separate Ryuk rule created for VBurovs strings
2019-08-06 10:33:46 +02:00
eb8a0636c5
Update win_mal_ursnif.yml
...
After @thomaspatzke changed to HKU, I did some reading. HKU is for HKEY_User, not HKEY_Current_User (what this threat is tied to. However, he was correct that HKCU does not exist as a prefix for sysmon (see the notes section under event id 13 here: https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml ). Changed to ignore the key name, confirmed that the key is still uniique.
2019-04-14 11:51:13 -05:00
c922f7d73f
Merge branch 'master' into project-1
2019-02-26 00:24:46 +01:00
afa18245bf
Merge pull request #254 from darkquasar/master
...
adding MPreter as McAfee classifies it
2019-02-23 07:34:04 +01:00
02239fa288
Changed registry root key
...
According to [this](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-12-registryevent-object-create-and-delete ) it is abbreviated to HKU.
2019-02-22 21:30:30 +01:00
87994ca46b
adding MPreter as McAfee classifies it
...
McAfee classifies some Meterpreter events with the "Mpreter" keyword
2019-02-22 15:22:10 +11:00
Jonhnathan